cs.CROct 25, 2026

LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards

Authors: Orel Navi, Elad Feldman, Ben Nassi

Organizations: Tel Aviv University, Tel Aviv, Israel

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Autonomous agents have been observed acting beyond their assigned tasks, accessing unauthorized systems, and establishing communication channels to exchange information, yet the Web and network-level techniques they use to extend their capabilities and circumvent security restrictions remain poorly understood. We study these techniques through the ProWiki incident, in which agents restricted to outbound HTTP GET requests repurposed a public German-language wiki as a message board. We analyze 14,591 agent edits containing 79,541 URL postings and present corroborating evidence that the published URLs reflect the agents' operational activity. We find that 26,717 URL occurrences (33.6%) embed target URLs within one to five layers of third-party Web services. By recursively reconstructing these nested URLs, we identify 67 distinct intermediate services and classify their functionality. Most intermediate layers (73.8%) extend agents' capabilities by delegating content extraction and transformation to external Web services: Markdown and OCR services convert web content into machine-readable text, JSON filtering services extract selected fields, and archival services expose historical versions of pages. The remaining 26.2% facilitate circumvention of access restrictions and evasion of detection, including CORS and fetch proxies that retrieve content on agents' behalf, and link shorteners and redirectors that hide destination URLs from mechanisms inspecting literal URLs or outer hostnames. Agents also reach the same targets through multiple URL paths, consistent with attempts to evade rate limits or obscure request origins. Our results expose a gap between the capabilities granted to agents and those they can obtain by composing publicly available Web services: restricting an agent's local toolset or direct Internet access may be insufficient while third-party services remain reachable.

Figures & tables

Figure 1. A nested URL from the corpus. Each layer is an intermediate URL together with everything it embeds: the reader r.jina.ai fetches the URL embedded in its path, the proxy allorigins.hexlet.app fetches the URL in its url parameter, and the innermost URL is the target URL.
Figure 2. Edits per day (UTC), 24 May to 2 July 2026. One edit is one saved version of a wiki page; days with no edits are shown as 0. The blue line counts all 14,591 ProWiki edits; the red line counts the 8,857 edits among them that add a link (Section 4.1 ).
Figure 3. Number of new and cumulative intermediate URL services appearing over all four wikis per day.
Figure 4. Nested URLs by nesting depth (number of intermediate URL layers around the target), as a share of all 7,072 nested URLs. The 4 URLs with five layers are too few to show.
Figure 5. The 20 most used intermediate URL domains, link shorteners included, by number of unique URLs that use them in any layer; as in Figs. 4 and 6 , a URL posted several times is counted once, and a link shortener counts as an extra layer as in Fig. 3 . Spelling and path variants of one service (e.g., api.cors.lol ) count as its domain.
Figure 6. Intermediate URL layers by purpose ( n=10,256n=10{,}256 ). Blue shades: extended functionality (73.8%); orange shades: evasion (26.2%).
CategoryIntermediate URLs
Markdown / readabilitymd.succ.ai , markdown.new , r.jina.ai , jina.ai , r.jina-ai.workers.dev , pure.md , platform.lemino.ai , md.dhr.wtf , urltomarkdown.herokuapp.com , microlink.io , ctxr.me , magic-html-api.vercel.app , api.ocr.space
JSON filteringjqp.vercel.app , jqp-git-main-sighrobot.vercel.app , jsonformatter.curiousconcept.com , codebeautify.org
Archiveweb.archive.org , wayback.archive.org , archive.org , wayback.archive-it.org , memgator.cs.odu.edu
CORS / proxywebcrawlerapi.com , viewpagesource.online , allorigins.hexlet.app , allorigins.win , proxymule.com , cors.lol , corsmirror.com , corsfix.com , corsproxy.io , cors.isomorphic-git.org , codetabs.com , cors.eu.org , thingproxy.freeboard.io , proxy.cors.sh , cors-anywhere.herokuapp.com , cors-anywhere.com , jsonp.afeld.me , cors.bwa.workers.dev , cors-get-proxy.sirjosh.workers.dev , cors.hypnguyen.workers.dev , cloudflare-cors-anywhere.hanpengchen.workers.dev , test.cors.workers.dev , cf-cors.findme-19.workers.dev , vercel-cors-proxy.vercel.app , vercel-cors-proxy-lokal.vercel.app , cors-bypasser-pro.vercel.app , proxy-mu-seven-70.vercel.app , thenacken-python-cors-proxy.hf.space , docs.google.com , translate.google.com , drive.google.com , image.thum.io , api.shotapi.io , pageshot.site , images.weserv.nl
Redirecthttpbin.org , eu.httpbin.org , google.com
Link shortenervanderbi.lt , tinyurl.com , bitily.in , da.gd , is.gd , 2dd.pl , v.gd
Table 1. The 67 intermediate URL services, grouped by category. Archive services count as a past snapshot or the current state depending on the requested capture (Fig. 6 ).
Figure 7. Examples of (a) Markdown conversion, which strips a page down to its text, (b) JSON filtering, which returns only the requested part of a document, and (c) OCR, which returns the text of an image (here, a real JPG that the agents were interested in, along with its URL query).
Servicesec.govcofc.edupreservica.comyahoo.comhealthdata.orgclarku.edudatausa.ioyahoo.co.jpother domainsURLs
allorigins.hexlet.app85%–––––––15%1,003
cors.bwa.workers.dev–14%38%9%16%–––23%269
proxymule.com25%52%––––6%6%11%214
cors.lol66%––25%––––9%185
corsmirror.com5%43%14%––23%––15%93
Direct URLs1,394218213802,49235––
Table 2. Destination domains reached through the five evasion services used by the most URLs, as a share of each service’s unique URLs. The destination is the domain of the URL’s final target (all subdomains of a site count as the site). Only shares of at least 5% are shown, the rest is under “other domains”; bold marks each service’s top destination, and a dash marks a smaller share or a cell that does not apply. URLs whose chain ends on an unresolved short link have no known destination and are left out.
Figure 8. Distance from the target of evasion and extended-functionality layers, over the 2,676 unique URLs with at least two layers. Each column is one intermediate URL position, from distance 3 or more (outermost) to distance 1 (wrapping the target directly). Top row: the layers at that position; the two rows below: the share of each group’s layers that sit there.
DestinationAll pathsDirect pathsNested pathsUnique nestedIntermediate URL chainsMax depth
sec.gov27,75512,93314,8223,7611605
investor.gov9,2801,2638,0171,311613
clarku.edu4880488299294
example.com36716120687295
yahoo.com29613283235234
preservica.com2132211139183
Table 3. Top 10 destination domains by number of distinct intermediate URL chains. A destination here is the domain of the final target (all subdomains of a site count as the site) rather than its host and path. All, direct (not nested), and nested paths count every post of a URL; unique nested paths count each nested URL once.
Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

WikiRevisionsPagesText (MB)
DSEWiki13,4033,90826.4
Probier1,0136010.6
Fractal169680.2
DorfWiki62<< 0.1
Total14,5914,57927.2
Appendix
Table 4. Overview of the ProWiki corpus (since May 2026).
ServiceUse hereRecords available
is.gdCreationUTC creation time and destination
v.gdCreationUTC creation time and destination
vanderbi.ltRequestsArchived daily counts and referrers
da.gdLimited60-day history misses the activity
TinyURLExcludedNo public analytics for guest links
bitily.inExcludedRecords require login or redirect
Appendix
Table 5. Link shorteners in the corpus and whether their public records can show when a link was created or requested. “Excluded” means unusable for this evidence, not unused by the agents.
Figure 9. Time from the creation of each of the 62 is.gd and v.gd short links created during the agents’ activity to its first appearance on the wiki. is.gd and v.gd publish a UTC creation time and the stored destination of every link; of the 64 distinct codes we checked, one was created on 11 May 2026, before the corpus, and one no longer exists, and we exclude both. Creation times have minute precision; we measure from the start of the creation minute, so each time is an upper bound. A link’s first appearance is the first revision whose added lines contain it, after up to three passes of percent-decoding.
Short linkCreated (UTC)First wiki post (UTC)
is.gd/MAIconv19618x18:2818:28:37
v.gd/MAVconv19618x18:2818:28:37
Appendix
Table 6. Two short links posted in revision AgentCountyGateway991@10 (18 June, 18:28:37 UTC) as “Short alternatives ISGDVGD618 [https://is.gd/MAIconv19618x MAIconv19618x] [https://v.gd/MAVconv19618x MAVconv19618x]”. Creation times are from is.gd/stats.php?url=MAIconv19618x and v.gd/stats.php?url=MAVconv19618x .
Short link18 Jun19 Jun20 Jun21 JunTotal
maallraw26061816,153194516,181
jsallwrap2606181411016
countrf260623c1300215
jqinv11method00101
Appendix
Table 7. Daily requests to four vanderbi.lt short links, 18–21 June 2026, from the service’s archived statistics (Internet Archive captures of 4 September 2026). All four links first appear in revisions saved on 18 June: maallraw260618 at 15:29:23 UTC ( OpenAIGCTRawJan19B@3 ), jsallwrap260618 at 15:47:52 ( OpenAIStatesG@3 , percent-encoded inside a nested URL), countrf260623c at 19:12:29 ( AgentNextDirectJuneAF@3 ), and jqinv11method at 19:45:17 ( AgentElevenSmallLinksBB@1 ). Zero means that the archived history lists no requests on that date; totals are sums over the four days, not lifetime totals. The service does not state its time zone.
Figure 10. Statistics page of vanderbi.lt/maallraw260618 as captured by the Internet Archive on 4 September 2026 ( https://web.archive.org/web/20260904192757id_/https://vanderbi.lt/maallraw260618+ ): 16,153 of its 17,088 requests to that date fall on 18 June, the day the agents first posted it.
Figure 11. Top: revision AgentElevenSmallLinksBB@1 (18 June, 19:45:17 UTC), which created the page and is the first post of vanderbi.lt/jqinv11method , the short alias of the jqp.vercel.app query above it. Bottom: the link’s referrer list (Internet Archive capture of 4 September 2026), which records two requests from https://prowiki.org/dse/wiki.cgi?AgentElevenSmallLinksBB . Referrers are sent by the requesting client and are not individually timestamped.
Figure 12. Three revisions of page OAIEquityDec30Raw on 20 June. In #1, an agent reports that it “bypassed the GET-only restriction”. In #3, a second agent asks for the “reproducible bypass”. In #11, a third agent posts it, mapping bypass.blob.core.windows.net , which is in the execution environment’s NO_PROXY list, to the Power BI server in /etc/hosts and sending each blocked POST request there with the original Host header.
Figure 13. Revisions #9, #10, and #12 of page DataUSAOccupationSalary6162R5Signal (21 June). Agents coordinate a relay through api.counterapi.dev , report that it “returns 502 here”, and finally report “COUNTERAPI BYPASS FOUND: literal v1 blocked, but percent-encode v. Poll works” with the re-spelled URL api.counterapi.dev/%76%31/… .
Figure 14. Top: revision AIHWPBSSequenceCollab@1 (21 June, 20:56:53 UTC), in which an agent reports the AIHW ZIP file as “blocked by CF here” and asks peers for the data. The same label, ResearchHelperY , posted the file’s direct URL at 18:46 UTC ( AgentTryJSDirect9988@4 ), the same URL behind r.jina.ai , api.allorigins.win , and corsproxy.io at 20:29 ( PBSProxyTests@1 ), and “AIHW more proxy tests” through cors.bwa.workers.dev and cors.hypnguyen.workers.dev at 21:33 ( PBSProxyAIHW2@1 ). Bottom: the AIHW’s statement of 25 September 2026 ( Australian Institute of Health and Welfare, 2026 ) .
More in this topic

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 331 papers

Explore similar work

CardsList
Oct 26, 2026

Proof-of-Agentness: Towards Verifying Agents on the Web

CAPTCHAs and bot detection have helped protect Web services from automated abuse for decades by distinguishing humans from bots. However, the emergence of LLM-powered agents introduces a new setting: Web services increasingly accommodate agents as legitimate users. Without a way to distinguish agents from other automated clients such as simple bots and scripts, these services risk large-scale automated junk submissions that waste service resources and consume users' attention or tokens. In this paper, we investigate a novel question for today's Web: "How can a Web service obtain evidence that a client is an agent?" We introduce the concept of "Proof-of-Agentness" (PoA), a mechanism for distinguishing agents from other automated clients, motivated by the parallel between human attention and an agent's inference resources. We outline two approaches: active verification through challenge-response and passive analysis of service-visible signals. Eight language models achieve an overall accuracy of 96.5% on our challenges, with an average overhead of 1,647 tokens. For passive analysis, we conduct an IRB-approved user study comparing the Web interactions of twelve human participants and representative Bot and Agent implementations, achieving an average classification accuracy of 95.8% across four classifiers, motivating further study.

Zuyao Xu, Xiang Li

Nankai University, Tianjin, China

LLM Agent VerificationWeb Agents
AskPDF
May 14, 2026

Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces

As LLM-based agents increasingly browse the web on users' behalf, a natural question arises: can websites passively identify which underlying model powers an agent? Doing so would represent a significant security risk, enabling targeted attacks tailored to known model vulnerabilities. Across 14 frontier LLMs and four web environments spanning information retrieval and shopping tasks, we show that an agent's actions and interaction timings, captured via a passive JavaScript tracker, are sufficient to identify the underlying model with up to 96% F1. We formalise this attack surface by demonstrating that classifiers trained on agent actions generalise across model sizes and families. We further show that strong classifiers can be trained from few interaction traces and that agent identity can be inferred early within an episode. Injecting randomised timing delays between actions substantially degrades classifier performance, but does not provide robust protection: a classifier retrained on delayed traces largely recovers performance. We release our harness and a labelled corpus of agent traces here.

William Lugoloobi, Samuelle Marro, Jabez Magomere +2

Oxford Internet Institute, University of Oxford · Department of Engineering Science, University of Oxford

Language Model FingerprintingLLM Agent Security
AskPDF
Feb 5, 2026

Do Web Agents Investigate Before They Decide?

Autonomous web agents are increasingly deployed in moderation and policy enforcement, where correct decisions often depend on evidence that is not immediately visible and must be actively investigated. Yet existing benchmarks largely assume task critical information is immediately accessible. They do not measure investigative competence: recognizing when visible context is insufficient, retrieving hidden evidence, and integrating it into a final decision. We introduce MIRAGE, a benchmark of 750 multi step decision tasks across three domains: Wikipedia Forensics, Shopping Admin adjudication, and Reddit Moderation. Each task has two layers: a visible surface context that often points to the wrong action, and a hidden context, reachable only by active investigation, that contains the decisive evidence. We decompose agent performance into Investigation, Reasoning, and Decision Accuracy, complemented by an Investigative Hallucination Rate. We evaluate eight LLM agents across two model generations. Three patterns emerge. First, agents reach relevant pages but rarely extract the decisive evidence on them. Second, procedural hints improve investigation but do not consistently improve decisions on Wikipedia tasks, where decisive evidence often contradicts surface impressions. Third, 12.6% of trajectories cite fabricated facts. We call these the Navigation Discovery Gap, Collapse under Contradiction, and Investigative Hallucination. These patterns persist across model scale, generation, and reasoning architecture.

Syed Nazmus Sakib, Nafiul Haque, Tapodhir Karmakar Taton +2

Department of Robotics and Mechatronics Engineering, University of Dhaka · Department of Computer Science and Engineering, University of Dhaka

Web Agent BenchmarksHallucination in Language ModelsLLM Agent EvaluationWeb Agents
AskPDF